Android 17 adds four important network defenses: Encrypted Client Hello (ECH), mandatory local-network permission for newly updated apps, Certificate Transparency by default, and a carrier option to disable insecure 2G automatically. Most protections work behind the scenes, but users should keep Private DNS enabled, review new local-network prompts carefully, and consider Android Advanced Protection on supported devices.259
Android 17 security checklist
Use this quick checklist after your phone receives Android 17.2
- Install the Android 17 system update and current security updates.2 The new protections depend on the operating system, and some app-level behavior also depends on developers targeting Android 17.57
- Keep Private DNS on.6 Open Settings → Network & internet → Private DNS, then choose Automatic unless your organization or trusted DNS provider requires a specific hostname.6 Google recommends leaving Private DNS enabled.6
- Treat new local-network prompts as sensitive.7 Allow access when an app genuinely needs to find a TV, printer, speaker, smart-home hub or another device on your Wi-Fi.7 Deny it when the request does not match the app’s purpose.7
- If casting or printing stops working, check the app’s permission first.7 Android 17 blocks local-network access by default for apps that target API level 37 unless they request the new permission.7 Older apps retain temporary compatibility until they update their target SDK.7
- Consider Advanced Protection.9 On supported devices, go to Settings → Security & privacy → Advanced Protection and turn on Device protection.9 Google says this mode can prevent connections to less-secure 2G networks, although that may remove service where only 2G coverage exists.9
What changed in Android 17?
Google announced the network-security package on August 27, 2026. The four changes address different parts of a connection: the hostname exposed during a secure connection, access to devices inside your home network, fraudulent web certificates, and downgrade attacks that push phones onto old 2G networks.2
| Android 17 feature | What it protects | User action |
|---|---|---|
| Encrypted Client Hello (ECH) | Helps hide the hostname an app connects to from network intermediaries | Keep Android and apps updated; keep Private DNS enabled |
| Local Network Protection | Stops apps from silently scanning or connecting to devices on your LAN | Approve only justified permission requests |
| Certificate Transparency | Makes publicly trusted certificates subject to public-log checks | No normal setup required |
| 2G network protection | Reduces exposure to fake base stations and SMS blasters that exploit 2G | Use Advanced Protection where supported; carrier behavior varies |
1. Encrypted Client Hello hides more of the connection setup
HTTPS encrypts the content exchanged with a website, but the Server Name Indication in the opening TLS handshake has traditionally exposed the hostname being requested.5 ECH encrypts that field.5 Android 17, API level 37, adds platform support so compatible apps and libraries can prevent network intermediaries from seeing the hostnames they contact.5
This is not a switch that instantly protects every app and website.5 Android’s developer documentation says an app must run on Android 17, use an ECH-capable networking library and connect to a server that supports ECH.5 The documentation also notes that ECH support is coming to OkHttp and HttpEngine, so coverage will grow as apps and networking components update.5
Do you need to turn on ECH?
Usually, no. Google describes the Android 17 protections as working behind the scenes, while the app and networking-library requirements sit with developers.25 Your practical tasks are to install updates and avoid turning off Private DNS without a clear reason.
Private DNS protects DNS questions and answers, and Google recommends keeping it on. Its settings are under Settings → Network & internet → Private DNS on standard Android, although manufacturers may rename or move the menu.6
2. Apps must ask before scanning your local network
A local network can reveal more than a Wi-Fi connection.7 Apps may discover TVs, printers, speakers, computers, smart-home devices and services advertised through protocols such as mDNS or SSDP.7 Android’s documentation says this can contribute to device fingerprinting or act as a proxy for location.7
Starting with Android 17, apps targeting SDK 37 or higher are blocked from local-network access unless they declare and receive the new ACCESS_LOCAL_NETWORK runtime permission. The restriction covers incoming and outgoing TCP connections, UDP traffic, broadcasts, multicast traffic and service discovery on local addresses.7
Which apps should receive local-network access?
A request is reasonable when the feature you are using needs a nearby device, for example:7
- casting a video to a television;
- sending a document to a Wi-Fi printer;
- controlling a smart-home hub;
- finding a speaker or media receiver;
- connecting to a local server or network-attached storage device.
Be cautious when a calculator, wallpaper app, basic game or unrelated utility asks to scan the local network.7 You can deny the request and allow it later if a legitimate feature fails.7
Why an old app may not show the prompt
The new restriction is tied to an app’s target SDK. Apps targeting Android 17 or later must request access, while legacy apps below SDK 37 temporarily retain local-network access through their existing internet permission. That compatibility behavior ends for an app when its developer updates the target level.7
3. Certificate Transparency becomes a default defense
A secure connection relies on a certificate to prove that the destination is authentic.2 If a certificate authority is compromised or issues an unauthorized certificate, an attacker may attempt to impersonate a site.2 Android 17 enables Certificate Transparency by default so publicly trusted certificates are checked against public logs, making suspicious issuance more visible.2
Android’s CT policy requires certificates used by CT-enforcing apps to include valid Signed Certificate Timestamps from qualified logs. The exact number and delivery requirements depend on the certificate lifetime and how those timestamps are supplied.8
For most users, this requires no setup.2 Website owners and app developers should, however, test certificate chains and watch for CT-related failures after targeting Android 17.8
4. Android 17 strengthens protection against 2G downgrade attacks
Google says scammers can use portable false base stations, sometimes called SMS blasters, to target people in crowded places. Android 12 introduced a manual hardware-level option to disable 2G. Android 17 adds a zero-click route that lets participating carriers disable 2G by default for their subscribers.2
Carrier participation and device support matter, so do not assume every Android 17 phone has 2G disabled. Users who want a stronger device-wide security posture can check Android Advanced Protection. On supported devices, its 2G Network Protection prevents connections to less-secure 2G networks. Google warns that this can also prevent cellular service where 2G is the only available network.9
How to enable Android Advanced Protection
- Open Settings.9
- Tap Security & privacy.9
- Under Other settings, tap Advanced Protection.9
- Turn on Device protection.9
- Authenticate and restart if prompted.9
A screen lock is required. Google also offers an alternative route through Settings → Google → All services → Advanced Protection.9
Fix casting, printer or smart-home problems after Android 17
If a nearby device disappears after an app update, use this order:
- Confirm the phone and target device are on the same Wi-Fi network.
- Reopen the app and attempt the cast, print or discovery action so Android can display the permission request.
- If you previously denied the request, open the app’s system settings and review its permissions. Menu names can vary by phone maker.
- Update the app. Android 17 introduces a new permission model, and older implementations may need a developer fix.7
- Prefer a system device picker when the app offers one. Android recommends privacy-preserving pickers for casting because they can let you choose a device without granting broad access to the whole local network.7
Do not disable Private DNS as a first-line casting fix. Android’s local-network documentation explicitly exempts normal DNS traffic to a local DNS server from the new permission, while Private DNS provides a separate protection for DNS queries and responses.67
What Android users should remember
The headline is not that Android 17 makes every connection invisible.5
The operating system now protects more connection metadata, restricts silent access to nearby devices, makes certificate misuse easier to detect, and gives carriers and supported devices stronger options against 2G downgrade attacks.278
The best user response is simple: update the operating system and apps, keep Private DNS enabled, approve local-network access only when the feature makes sense, and enable Advanced Protection if its trade-offs fit your coverage needs.69
FAQ
Is Encrypted Client Hello automatically enabled on Android 17?
Android 17 supports ECH by default, but actual use depends on the app’s target version, its networking library and the destination server. It is therefore better understood as platform support that expands as the ecosystem updates, not universal protection for every connection on day one.5
Does ECH replace a VPN?
No. Android’s ECH documentation describes protection for the hostname in the TLS handshake. It does not describe ECH as a general traffic tunnel or VPN replacement.5
Why is Android asking an app to find devices on my local network?
Apps targeting Android 17 must request permission before making many local-network connections. Casting, printing, smart-home control and local service discovery are common legitimate reasons.7
Should I allow local-network access to every app?
No.7 Approve the request only when the app has a clear nearby-device feature you intend to use.7 Denying an unrelated request is the safer default.7
Will Android 17 disable 2G on every phone?
No. Google describes automatic 2G disabling as a capability for participating carriers. Advanced Protection can block 2G on supported devices, but coverage and hardware support vary.29
Can blocking 2G cause loss of service?
Yes. Google warns that 2G Network Protection may prevent a device from connecting in places where only 2G coverage is available.9